Unprivileged sandboxing tool, namespaces-powered chroot-like solution
https://github.com/containers/bubblewrap/